Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Need help setting up IOS firewall

I am trying to setup my 2514 with 12.2 IOS firewall.

What I want to do is use my E0 as local lan , and use E1 as DMZ. S0 being the interface connected to Internet and s1 connected to another router which will be our WAN connected to remote office.

the way it should be is how PIX firewall works.

that is any traffic from E0 going to E1, S0 and S1 should be permitted. Traffic coming back to E0 from any interface with the exception of S1 (WAN interface to remote office) should be denied.

Traffic from E1 (DMZ) should be permitted to go out to S0 (internet interface) and denied everywhere else. Traffic from S1 (Wan interface) should be permitted to E0 and E1 except S0.

Can someone help me with the access-list here..

Below is my unsuccesful attempt

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname NewYork

!

enable secret xxxx

enable password technology

!

ip subnet-zero

no ip source-route

!

ip inspect audit-trail

ip inspect udp idle-time 1800

ip inspect dns-timeout 7

ip inspect tcp idle-time 14400

ip inspect name standard cuseeme

ip inspect name standard ftp

ip inspect name standard h323

ip inspect name standard http

ip inspect name standard rcmd

ip inspect name standard realaudio

ip inspect name standard smtp

ip inspect name standard sqlnet

ip inspect name standard streamworks

ip inspect name standard tcp

ip inspect name standard tftp

ip inspect name standard udp

ip inspect name standard vdolive

!

!

!

!

interface Ethernet0

ip address 172.16.10.1 255.255.255.0

ip access-group 101 in

ip access-group 101 out

ip inspect standard in

no cdp enable

!

interface Ethernet1

ip address 172.16.20.1 255.255.255.0

ip access-group 111 in

ip inspect standard out

no cdp enable

!

interface Serial0

ip address 192.168.20.1 255.255.255.0

ip access-group 121 in

shutdown

no cdp enable

!

interface Serial1

ip address 192.168.10.1 255.255.255.0

ip access-group 131 in

ip access-group 102 out

shutdown

no cdp enable

!

ip classless

no ip http server

ip pim bidir-enable

!

!

logging 172.16.10.110

access-list 101 permit icmp 172.16.10.0

0.0.0.255 any

access-list 101 permit ip 192.168.10.0 0.0.0.255 172.16.10.0 0.0.0.255

access-list 101 deny ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255

access-list 101 deny ip 192.168.20.0 0.0.0.255 172.16.10.0 0.0.0.

access-list 102 deny ip 172.16.20.0 0.0.0.255 192.168.10.0 0.0.0.255

access-list 102 permit ip any any

access-list 111 deny ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255

access-list 111 deny ip 172.16.20.0 0.0.0.255 172.16.30.0 0.0.0.255

access-list 111 permit ip 172.16.20.0 0.0.0.255 any

access-list 111 permit icmp 172.16.20.0 0.0.0.255 any

access-list 111 deny ip any any

access-list 121 permit udp any host 172.16.20.3 eq domain access-list 121 permit tcp any host 172.16.20.3 eq domain access-list 121 permit tcp any host 172.16.20.3 eq www access-list 121 permit tcp any host 172.16.20.3 eq ftp access-list 121 permit tcp any host 172.16.20.3 eq ftp-data access-list 121 permit tcp any gt 1023 host 172.16.20.3 gt telnet access-list 121 permit tcp any host 172.16.20.3 eq smtp access-list 121 permit icmp any 172.16.20.0 0.0.0.255 administratively-prohibited access-list 121 permit icmp any 172.16.20.0 0.0.0.255 echo access-list 121 permit icmp any 172.16.20.0 0.0.0.255 echo-reply access-list 121 permit icmp any 172.16.20.0 0.0.0.255 packet-too-big access-list 121 permit icmp any 172.16.20.0 0.0.0.255 time-exceeded access-list 121 permit icmp any 172.16.20.0 0.0.0.255 traceroute access-list 121 permit icmp any 172.16.20.0 0.0.0.255 unreachable

access-list 121 deny ip any any

access-list 131 permit ip 192.168.10.0 0.0.0.255 172.16.10.0 0.0.0.255 access-list 131 permit ip 192.168.10.0 0.0.0.255 172.16.20.0 0.0.0.255

access-list 131 deny ip any any

no cdp run

!

!

line con 0

line aux 0

line vty 0 4

password xxxx

login

!

end

1 REPLY
Silver

Re: Need help setting up IOS firewall

HI,

E0 as Inside

E1 as DMZ1

S1 as DMZ2

S0 as outside.

from E0 to E1,S0 and S1, allowed

traffic from S1 to E0 allowd

Solution : apply inspect on E0

apply access-list on E1,S0 and S1 to block unwanted traffic

Traffic from E1 to S0 is allowd

Apply inspect on E1

apply access-list on E1 to block/permit traffic

Traffic from S1 to E0 and E1 allowd

apply access-list to only allow this traffic

Thanks

Nadeem

119
Views
0
Helpful
1
Replies
CreatePlease to create content